On Fri, Apr 08, 2011 at 04:27:44PM +0200, Jan-Pieter Cornet wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Actually, if you give an account just the capabilities
"login-ssh,cli-options", then that account will ONLY be able to run the
'options' command (which will list all current option settings), and it
will not be able to change any options.
That was what I tried first, but it doesn't seem to work.
# ssh testfiler useradmin user list monitor
Name: monitor
Info:
Rid: 131075
Groups: Monitors
Full Name:
Allowed Capabilities: login-ssh,cli-options
Password min/max age in days: 0/4294967295
Status: enabled
# ssh monitor@testfiler options autologout.telnet.timeout
monitor@testfiler's password:
autologout.telnet.timeout 60
# ssh monitor@testfiler options autologout.telnet.timeout 30
monitor@testfiler's password:
# ssh monitor@testfiler options autologout.telnet.timeout
monitor@testfiler's password:
autologout.telnet.timeout 30
So with just those two privs, it can change settings.
> > Likewise with the SDK, you can enable specific functions, in your case api-options-list-info and possibly api-options-get.
Hmm. I didn't realize the different privs available there. Even though
I have DFM and will probably use it for this task, I'm very interested
in knowing how the SDK could enable this to happen.
Thanks!
--
Darren